Modern software development is evolving away from the client-server model toward network-based processing systems that provide access to data and services via the Internet or other networks. In contrast to traditional systems that host networked applications on dedicated server hardware, a “cloud” computing model allows applications to be provided over the network “as a service” supplied by an infrastructure provider. The infrastructure provider typically abstracts the underlying hardware and other resources used to deliver a customer-developed application so that the customer no longer needs to operate and support dedicated server hardware. The cloud computing model can often provide substantial cost savings to the customer over the life of the application because the customer no longer needs to provide dedicated network infrastructure, electrical and temperature controls, physical security and other logistics in support of dedicated server hardware.
Multi-tenant cloud-based architectures have been developed to improve collaboration, integration, and community-based cooperation between customer tenants without sacrificing data security. Generally speaking, multi-tenancy refers to a system wherein a single hardware and software platform simultaneously supports multiple user groups (also referred to as “organizations” or “tenants”) from a common data store. The multi-tenant design provides a number of advantages over conventional server virtualization systems. The multi-tenant platform operator may make improvements to the platform based upon collective information from the entire tenant community, as well as improving collaboration and integration between applications and the data managed by the various applications. The multi-tenant architecture therefore allows convenient and cost effective sharing of similar application features between multiple sets of users.
In certain situations, it may be necessary or desirable to grant access to secure or protected data. If the “owner” of the protected data resources seeks access, then user credentials may be used (e.g., a username and password). If a “non-owner” of the protected data resources seeks access, then the non-owner may use the owner's credentials to gain access. Alternatively, authorization or authentication techniques or protocols may be employed to provide regulated access to the non-owner. For example, the OAuth authorization protocol may be used such that the owner's credentials need not be disclosed to the non-owner. In this regard, the OAuth authorization protocol calls for the use of access tokens that enable non-owners to access protected data resources without knowledge of the owner's credentials. The scope, duration, and amount of data access enabled by an access token may be configured and controlled as needed to limit, restrict, and/or prevent access to certain data. Unfortunately, the OAuth authorization protocol assumes that the end user is the owner of the data, and as such, only the end user may authorize access. However, if the end user is a member of an organization, the organization may want to place restrictions on, or otherwise administer access to, the protected data.
Accordingly, it is desirable to provide systems and methods for administrating access in an on-demand environment, particularly an environment that uses an OAuth authorization protocol. Furthermore, other desirable features and characteristics will become apparent from the subsequent detailed description and the appended claims, taken in conjunction with the accompanying drawings and the foregoing technical field and background.